hasherezade

#!/usr/bin/env python3

import os
import requests
import json

API_KEY = os.getenv("ANTHROPIC_API_KEY")
if not API_KEY:
    raise ValueError("Please set the ANTHROPIC_API_KEY environment variable.")

hasherezade

# Walk current function and print its disassembly
import ida_funcs
import ida_kernwin
import idautils
import ida_lines
import idc

def print_func_disasm(ea=None):
    """
    Walks from the beginning to the end of the function containing `ea`

hasherezade

kernel32;LoadLibraryW;1
kernel32;LoadLibraryA;1
kernel32;GetProcAddress;2
advapi32;RegQueryValueW;3
advapi32;RegOpenKeyExW;5
advapi32;RegQueryValueExW;6
kernel32;CreateFileW;6
kernel32;VirtualProtect;4
wininet;InternetCrackUrlA;4
wininet;InternetOpenA;5

hasherezade

import base64
import hashlib
import zlib
from ctypes import (
    CDLL,
    POINTER,
    LittleEndianStructure,
    c_size_t,
    c_ubyte,
    c_uint64,

hasherezade

#!/usr/bin/env python3

import malduck
import sys
import argparse

def main():
    parser = argparse.ArgumentParser(description="APLib unpacker")
    parser.add_argument('--inpath', dest="inpath", default=None, help="APLib compressed blob",
                            required=True)

hasherezade

#include <windows.h>
#include <stdio.h>

#pragma comment(lib, "ntdll.lib")

#define SystemBigPoolInformation 0x42
#define ThreadNameInformation 0x26

#define DATA_TO_COPY "AAAAAAAAAAAAABBBBBBBBBBBBBBBCCCCCCCCCCCCCCCDDDDDDDDDDDDDDD"

hasherezade

HANDLE find_thread(HANDLE hProcess, DWORD thAccess, bool guiOnly)
{
	DWORD targetPid = GetProcessId(hProcess);
	HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
	THREADENTRY32 thEntry = { sizeof(THREADENTRY32) };

	GUITHREADINFO gui = { 0 };
	gui.cbSize = sizeof(GUITHREADINFO);

	bool isGUIProcess = false;

hasherezade

package main

import (
	"fmt"
	"syscall"
	"unsafe"
)

var (
	peSieveDll  = syscall.NewLazyDLL("pe-sieve64.dll")

hasherezade

#include <iostream>
#include <Windows.h>

#pragma comment(lib,"LZ32.lib")

bool decompress(LPSTR infile, LPSTR outfile)
{
    INT hin, hout = 0;
    OFSTRUCT ofin = { 0 };
    OFSTRUCT ofout = { 0 };

hasherezade

#!/usr/bin/env python3

import sys, os, subprocess
import pefile
from pathlib import Path

def mal_unp_res_to_str(returncode):
    if returncode == (-1):
        return "ERROR"
    if returncode == 0: